Privacy Policy

This policy describes what Email Risk Radar collects when you use our website, dashboard, and API, and why. We built the underlying pipeline to minimize what we retain by default — most notably, a single email check is never stored with the address attached. Where that isn't the case (bulk jobs, described below), it's called out explicitly.

Account information. When you register, we store your email address and a securely hashed password. We never store your password in plain text.

Single email checks (POST /v1/email/check). The address you submit is processed in real time to produce a result and is not stored afterward. What we do retain against your account is usage metadata only — timestamp, processing time, HTTP status, decision (allow/review/block), and risk level. The submitted email address itself is never written to that usage record.

Bulk checks (POST /v1/email/bulk). This is the one place addresses are stored with an attached result: each submitted address is saved per row so you can retrieve results by job afterward. These records are tied to your account and are retained until you request deletion (see "Your rights" below) or your account is closed.

Domain and mailbox intelligence caches. To avoid redundant lookups, we cache DNS/MX/SPF/DMARC results and domain registration age by domain — this contains no personal data, only domain-level facts. SMTP verification results are cached keyed by a one-way cryptographic hash of the normalized email address, never the address itself, and this cache is shared infrastructure rather than tied to any individual account.

Payment information. Payments are processed by Stripe. We store a Stripe customer/subscription reference to manage your plan, but we never receive or store your card details ourselves.

Anonymous demo usage. The public "try it free" demo on our marketing site tracks your IP address and a single-use token, temporarily, solely to enforce rate limits and prevent abuse. This is not written to our primary database and expires automatically.

Webhook delivery logs. If you register a webhook endpoint, we log delivery attempts (event type, status code, success/failure, timestamp) so you can debug delivery issues. Webhook payloads for bulk job events contain job-level counts (how many addresses were allowed/reviewed/blocked), not the individual addresses themselves.

• To operate the account, API keys, and dashboard you're using
• To process email checks and return a result
• To enforce plan quotas, rate limits, and billing
• To detect and prevent abuse of the free demo and the wider API
• To communicate with you about your account (billing issues, service notices)
• Where you've accepted analytics cookies, to understand aggregate site traffic on the marketing site (see "Cookies" below) — this does not apply to the dashboard or API

We do not sell personal data, and we do not use it for advertising.

If you're in the UK or EEA, we rely on the following legal bases under the GDPR for each category of processing above:

• Contract. Account, API key, billing, and email-check processing is necessary to provide the service you signed up for.
• Legitimate interests. Anti-abuse measures on the free demo, rate limiting, and domain/mailbox intelligence caching are processed under our legitimate interest in operating a reliable, abuse-resistant service — balanced against your rights, and never involving anything beyond domain-level facts or a one-way hash of an email address (see "What we collect" above).
• Consent. Google Analytics on the marketing site (see "Cookies" below) only runs if you accept the cookie banner — it never loads before that choice, and declining or ignoring the banner means it never runs at all. We don't run any other consent-based processing (no marketing emails, no advertising cookies).

• Stripe — payment processing for subscriptions and one-time purchases. Stripe's own privacy policy governs the card data it handles directly.
• Public DNS resolvers and RDAP registries — used to look up MX/SPF/DMARC records and domain registration dates. These lookups query the domain of an email address, not the address itself.
• The recipient mail server itself — when you request "full" mode verification, we briefly connect to the target domain's mail server to ask (without sending any message) whether it will accept mail for the address being checked. That mail server sees a connection from our infrastructure as part of this process.
• Google Analytics — traffic analytics on the marketing site only, and only if you accept the cookie banner. See "Cookies" below for what it collects. Google Search Console verifies domain ownership for search-visibility purposes and doesn't process visitor data at all — it's not a tracking mechanism.

• Single-check addresses: not retained at all after the response is returned
• Bulk-check addresses and results: retained until you request deletion or close your account
• Domain-level DNS/age caches: retained on a rolling expiry (they refresh automatically; not tied to any user)
• SMTP verification hash cache: retained on a rolling expiry, never reversible back to an email address
• Account and billing records: retained for as long as your account is active, and as required afterward for legitimate accounting/legal purposes

Under the GDPR (if you're in the UK or EEA) and similar data-protection laws elsewhere, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your account, bulk-check history, or other personal data ("right to be forgotten")
• Restriction — ask us to limit how we process your data in certain circumstances
• Portability — receive your data in a structured, commonly-used format
• Objection — object to processing based on legitimate interests (see "Legal basis for processing" above)
• Withdraw consent — for any future processing that relies on consent, at any time
• Lodge a complaint — with your local data-protection supervisory authority (in the UK, the ICO) if you believe we've mishandled your data

Erasure is self-service. Go to Settings in the dashboard and use "Delete my account" — this immediately and permanently deletes your account, API keys, subscription, usage history, bulk-check jobs, and webhook endpoints. It requires re-entering your password and cannot be undone or recovered afterward.

For access, rectification, portability, or anything else on this list, email support@emailriskradar.com. Account deletion is self-service, from Settings in the dashboard — a data export isn't, so those requests are handled manually. We aim to respond within the timeframe required by applicable law (one month under the GDPR, extendable in complex cases).

• Passwords are hashed, never stored in plain text
• API keys are hashed at rest — only a short lookup prefix and the hash are stored, never the full key after creation
• Webhook payloads are signed with HMAC-SHA256 so you can verify a delivery genuinely came from us
• Bulk email addresses and account data are stored in an access-controlled database, not exposed publicly

Strictly necessary (no consent required). The dashboard stores your session token in your browser's local storage, not a cookie, solely to keep you signed in. This is necessary to provide the service you've asked for, so it doesn't require consent under GDPR/ePrivacy rules.

Analytics (only with your consent). The marketing site (not the dashboard) shows a cookie banner on your first visit. If you accept, we load Google Analytics, which sets its own cookies (typically _ga and _ga_*) to distinguish visitors and measure aggregate traffic — pages visited, referring site, approximate location from IP address, device/browser type. It does not run at all if you decline or don't respond to the banner, and it never runs on the dashboard regardless of your choice. You can withdraw consent at any time by clearing your browser's local storage for this site, which shows the banner again on your next visit.

Not a cookie or tracker. Google Search Console verifies domain ownership via a static meta tag — it doesn't set cookies, run scripts, or collect any visitor data, so it isn't part of the consent choice above.

We don't use any advertising cookies, and Google Analytics is not used for advertising or cross-site tracking — only aggregate site-traffic measurement.

This service is intended for business and developer use and is not directed at, marketed to, or designed for children of any age. Creating an account requires the ability to enter into a binding agreement, which by itself excludes children in most jurisdictions.

United States (COPPA). We do not knowingly collect personal information from children under 13. If we learn that we've collected personal information from a child under 13 without verifiable parental consent, we'll delete it promptly. A parent or guardian who believes their child has provided us personal information can contact support@emailriskradar.com to request its removal.

UK/EEA (GDPR). We do not knowingly collect personal data from anyone under 16, the digital age of consent in most EEA member states (some set it as low as 13 — the same contact above applies regardless of the exact age in your country).

Our servers are hosted in Meppel, Netherlands, within the European Economic Area. If you're in the EEA, your data is processed within the EEA and no international transfer occurs for hosting.

If you're in the UK, this is a transfer from the UK to the EEA — the UK government has issued an adequacy decision recognizing the EEA as providing an adequate level of data protection, so this transfer is permitted without any additional safeguard (such as Standard Contractual Clauses) being required. If you're outside the UK/EEA entirely, your data is still processed on EEA-based servers regardless of where you access the service from.

The above covers hosting specifically — our own servers. A few sub-processors we rely on (see "Third parties" above) separately process data outside the UK/EEA, each under its own safeguard:

• Stripe (payment processing, paid plans only) processes data in the US as well as the EEA/UK. Transfers are covered under Stripe's own Data Processing Agreement, which incorporates the UK International Data Transfer Addendum and the EU Standard Contractual Clauses for any transfer outside the UK/EEA.
• Google (Analytics and Search Console, only if you've consented to analytics cookies) processes data in the US. Google is a certified participant in the UK Extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge"), which the UK government recognizes as providing an adequate level of protection for this specific transfer.
• DNS, MX, RDAP and SMTP lookups (used to evaluate the domain half of an email address you submit for checking) are sent to whichever domain registry, nameserver, or mail server is authoritative for that domain, worldwide — this is how DNS and RDAP inherently work as public, decentralized protocols, not a transfer to a sub-processor under a data processing agreement, and no data beyond the domain name itself is sent.

We may update this policy as the product changes. Material changes will be reflected by updating the effective date above.

Questions about this policy or your data: support@emailriskradar.com